Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Corpus / ATT&CK

19 exploited techniques have no rule

339 ATT&CK techniques show up in this window's data: KEV CVEs mapped by MITRE CTID, techniques named in the last 90 days of research and advisories, and malware families that research names. Each is checked against SigmaHQ, Elastic and Splunk. A technique with activity and no rule is a gap, and goes in the queue for a thrunt rule. Click any cell for the CVEs, reports and rules behind it. Data as of 2026-11-07.

gap: active, no rule · 19 thrunt rule shipped · 23 community-covered · 257 (luminance = signal) pre-compromise, not gap-scored · 40
Reconnaissance 15
T1596.005 4 T1591 2 T1592 2 T1595 2 T1595.002 2 T1598.003 2 T1589.001 1 T1589.002 1 T1589.003 1 T1590 1 T1591.004 1 T1593.001 1 T1596.003 1 T1598 1 T1598.002 1
Resource Development 26
T1583.001 10 T1608.001 15 T1583.006 5 T1583 4 T1587.001 4 T1588.001 4 T1588.002 4 T1583.003 3 T1584.005 3 T1583.004 2 T1585.002 2 T1585.003 2 T1586.001 2 T1588 2 T1588.005 2 T1584 1 T1586.002 1 T1587 1 T1587.002 1 T1587.003 1 T1588.003 1 T1588.006 1 T1588.007 1 T1608 1 T1608.005 1 T1650 1
Initial Access 19
T1659 1 T1190 168 T1566.002 14 T1195.002 5 T1566.004 5 T1078 51 T1133 30 T1189 21 T1566 11 T1566.001 11 T1078.004 8 T1091 7 T1199 6 T1195 3 T1566.003 3 T1078.003 2 T1078.002 1 T1195.001 1 T1200 1
Execution 25
T1059 178 T1204.004 4 T1203 44 T1204.002 41 T1059.003 21 T1059.004 19 T1574 17 T1059.007 16 T1059.001 15 T1204.001 14 T1053.005 12 T1106 10 T1204 7 T1574.001 6 T1047 5 T1569.002 5 T1059.006 4 T1053 3 T1053.003 2 T1059.005 2 T1197 1 T1559 1 T1559.001 1 T1574.006 1 T1610 1
Persistence 48
T1542.005 1 T1505.003 34 T1037 5 T1098.005 4 T1098.004 2 T1078 51 T1133 30 T1053.005 12 T1543 12 T1136 10 T1547.001 10 T1112 9 T1078.004 8 T1543.003 5 T1136.001 4 T1053 3 T1098 3 T1098.001 3 T1098.003 3 T1556 3 T1053.003 2 T1078.003 2 T1505 2 T1547 2 T1547.009 2 T1037.001 1 T1037.004 1 T1078.002 1 T1137 1 T1137.006 1 T1197 1 T1546 1 T1546.001 1 T1546.002 1 T1546.003 1 T1546.004 1 T1546.007 1 T1546.010 1 T1546.012 1 T1546.013 1 T1546.015 1 T1547.002 1 T1547.004 1 T1547.005 1 T1547.008 1 T1547.010 1 T1556.006 1 T1653 1
Privilege Escalation 50
T1055 24 T1037 5 T1098.005 4 T1098.004 2 T1068 71 T1078 51 T1053.005 12 T1543 12 T1547.001 10 T1078.004 8 T1543.003 5 T1548 5 T1055.001 4 T1055.012 4 T1548.001 4 T1548.002 4 T1053 3 T1098 3 T1098.001 3 T1098.003 3 T1611 3 T1053.003 2 T1055.004 2 T1078.003 2 T1134 2 T1484.001 2 T1547 2 T1547.009 2 T1037.001 1 T1037.004 1 T1055.002 1 T1055.008 1 T1078.002 1 T1134.001 1 T1134.002 1 T1546 1 T1546.001 1 T1546.002 1 T1546.003 1 T1546.004 1 T1546.007 1 T1546.010 1 T1546.012 1 T1546.013 1 T1546.015 1 T1547.002 1 T1547.004 1 T1547.005 1 T1547.008 1 T1547.010 1
Defense Evasion 76
T1678 2 T1027.007 1 T1027.012 1 T1027.016 1 T1070.009 1 T1480.002 1 T1497.002 1 T1542.005 1 T1564.010 1 T1684 1 T1684.001 1 T1684.002 1 T1055 24 T1036 16 T1027.013 10 T1036.005 10 T1218.011 3 T1078 51 T1027 17 T1574 17 T1070.004 13 T1140 13 T1112 9 T1202 9 T1078.004 8 T1497 8 T1564.003 7 T1027.002 6 T1070 6 T1574.001 6 T1497.001 5 T1622 5 T1036.004 4 T1055.001 4 T1055.012 4 T1027.009 3 T1218 3 T1221 3 T1222 3 T1556 3 T1620 3 T1036.008 2 T1055.004 2 T1078.003 2 T1134 2 T1480 2 T1484.001 2 T1497.003 2 T1553 2 T1553.002 2 T1553.005 2 T1564 2 T1036.001 1 T1036.007 1 T1055.002 1 T1055.008 1 T1070.006 1 T1078.002 1 T1134.001 1 T1134.002 1 T1197 1 T1211 1 T1218.007 1 T1218.010 1 T1553.001 1 T1556.006 1 T1564.001 1 T1564.004 1 T1564.008 1 T1574.006 1 T1601 1 T1685 1 T1685.005 1 T1686 1 T1686.003 1 T1688 1
Credential Access 35
T1056.003 2 T1557 15 T1111 4 T1003 18 T1555 13 T1552.001 8 T1552 6 T1555.003 6 T1003.001 5 T1539 5 T1056.001 4 T1212 4 T1528 4 T1558 4 T1003.003 3 T1040 3 T1056 3 T1110 3 T1110.003 3 T1556 3 T1187 2 T1555.004 2 T1649 2 T1003.002 1 T1003.004 1 T1003.006 1 T1003.008 1 T1552.003 1 T1552.004 1 T1555.001 1 T1555.005 1 T1555.006 1 T1556.006 1 T1557.001 1 T1558.003 1
Discovery 35
T1497.002 1 T1680 1 T1082 22 T1083 14 T1016 12 T1046 12 T1087 10 T1497 8 T1033 7 T1217 7 T1018 6 T1057 6 T1518 6 T1518.001 6 T1087.002 5 T1497.001 5 T1614 5 T1622 5 T1010 4 T1012 4 T1040 3 T1526 3 T1007 2 T1049 2 T1069.002 2 T1087.004 2 T1120 2 T1482 2 T1497.003 2 T1069 1 T1087.001 1 T1124 1 T1135 1 T1580 1 T1614.001 1
Lateral Movement 12
T1091 7 T1550.002 5 T1021 4 T1210 4 T1021.001 3 T1021.004 3 T1570 2 T1021.002 1 T1021.005 1 T1550 1 T1550.001 1 T1550.004 1
Collection 23
T1056.003 2 T1557 15 T1005 59 T1113 8 T1560.001 7 T1056.001 4 T1114 4 T1119 4 T1056 3 T1074.001 3 T1115 3 T1185 3 T1213 3 T1560 3 T1039 2 T1530 2 T1114.002 1 T1123 1 T1125 1 T1557.001 1 T1560.002 1 T1602 1 T1602.002 1
Command and Control 26
T1573.001 10 T1001.001 1 T1659 1 T1665 1 T1105 52 T1219 10 T1573 5 T1102.001 3 T1071.004 2 T1071.001 28 T1071 7 T1090 7 T1571 6 T1090.001 4 T1095 4 T1001 3 T1090.003 3 T1132.001 3 T1572 3 T1071.002 2 T1102 2 T1573.002 2 T1008 1 T1090.002 1 T1102.002 1 T1219.002 1
Exfiltration 10
T1041 27 T1048 6 T1567 5 T1011 4 T1567.002 4 T1020 2 T1048.001 1 T1048.003 1 T1052.001 1 T1567.004 1
Impact 20
T1667 1 T1496 21 T1486 16 T1498 9 T1485 8 T1499 8 T1490 5 T1565 3 T1489 2 T1491.001 2 T1495 2 T1499.002 2 T1499.004 2 T1531 2 T1565.001 2 T1657 2 T1491.002 1 T1496.001 1 T1498.001 1 T1529 1

The full 14-tactic matrix is best on a wider screen. All 339 techniques, with their signal and coverage, are in the register below; the 19 gaps are marked gap.

420 cells for 339 techniques, because a technique with several tactics appears once per tactic. States are exclusive per technique: 19 + 23 + 257 + 40 = 339. Every cell is a link, so the matrix works without JavaScript.

Rules follow the headlines

The same 339 techniques, sorted by exploitation signal. Left channel: SigmaHQ, Elastic and Splunk rules tagged to the technique. Right channel: thrunt's composite signal (KEV CVE mappings, research citations, family activity). Both use the same square-root axis, so equal length means equal count. Techniques with the most signal also have the most rules. The 19 gaps (marked) sit in the low-signal tail: still in use, with no rule in any of the three public sets.

0 1 1 10 10 50 50 100 100 150 150 ← community rules exploitation signal →

The heaviest signal

T1059 Command and Scripting Interpreter carries the corpus's top signal (178) and 489 community rules. Here the rules kept up.

The most-covered

T1059 Command and Scripting Interpreter has 489 community rules against a signal of 178.

Where thrunt authors

The 19 gaps have low signal but are still in use, and no public rule covers them. They're ranked in the queue, and each rule we write cites the reports behind it.

The full register 339 techniques · signal-ranked
IDTechniqueSigKEVRulesState
T1059 Command and Scripting InterpreterE 178 170 489 rule
T1190 Exploit Public-Facing ApplicationIA 168 157 335 rule
T1068 Exploitation for Privilege EscalationPE 71 69 140
T1005 Data from Local SystemC 59 46 57
T1105 Ingress Tool TransferCaC 52 35 207 rule
T1078 Valid AccountsDE/P/PE/IA 51 46 325
T1203 Exploitation for Client ExecutionE 44 43 74
T1204.002 Malicious FileE 41 33 118
T1505.003 Web ShellP 34 26 75 rule
T1133 External Remote ServicesP/IA 30 25 77
T1071.001 Web ProtocolsCaC 28 10 92
T1041 Exfiltration Over C2 ChannelE 27 12 32
T1055 Process InjectionDE/PE 24 19 96 rule
T1082 System Information DiscoveryD 22 7 99
T1059.003 Windows Command ShellE 21 6 112
T1189 Drive-by CompromiseIA 21 21 13
T1496 Resource HijackingI 21 19 28
T1059.004 Unix ShellE 19 14 182
T1003 OS Credential DumpingCA 18 18 114
T1027 Obfuscated Files or InformationDE 17 5 153
T1574 Hijack Execution FlowDE/E 17 16 86
T1036 MasqueradingDE 16 2 134 rule
T1059.007 JavaScriptE 16 14 72
T1486 Data Encrypted for ImpactI 16 15 42
T1059.001 PowerShellE 15 1 410
T1557 Adversary-in-the-MiddleCA/C 15 4 37 rule
T1608.001 Upload MalwareRD 15 11 3 pre
T1083 File and Directory DiscoveryD 14 5 57
T1204.001 Malicious LinkE 14 11 10
T1566.002 Spearphishing LinkIA 14 5 51 rule
T1070.004 File DeletionDE 13 5 46
T1140 Deobfuscate/Decode Files or InformationDE 13 2 59
T1555 Credentials from Password StoresCA 13 9 44
T1016 System Network Configuration DiscoveryD 12 1 49
T1046 Network Service DiscoveryD 12 7 51
T1053.005 Scheduled TaskE/P/PE 12 2 95
T1543 Create or Modify System ProcessP/PE 12 9 107
T1566 PhishingIA 11 6 88
T1566.001 Spearphishing AttachmentIA 11 7 80
T1027.013 Encrypted/Encoded FileDE 10 0 5 rule
T1036.005 Match Legitimate Resource Name or LocationDE 10 1 59 rule
T1087 Account DiscoveryD 10 6 58
T1106 Native APIE 10 7 32
T1136 Create AccountP 10 10 38
T1219 Remote Access ToolsCaC 10 1 47 rule
T1547.001 Registry Run Keys / Startup FolderP/PE 10 1 59
T1573.001 Symmetric CryptographyCaC 10 3 0 gap
T1583.001 DomainsRD 10 0 2 rule
T1112 Modify RegistryDE/P 9 4 218
T1202 Indirect Command ExecutionDE 9 9 59
T1498 Network Denial of ServiceI 9 8 10
T1078.004 Cloud AccountsDE/P/PE/IA 8 1 223
T1113 Screen CaptureC 8 0 18
T1485 Data DestructionI 8 6 97
T1497 Virtualization/Sandbox EvasionDE/D 8 4 12
T1499 Endpoint Denial of ServiceI 8 7 14
T1552.001 Credentials In FilesCA 8 3 69
T1033 System Owner/User DiscoveryD 7 2 67
T1071 Application Layer ProtocolCaC 7 1 118
T1090 ProxyCaC 7 3 52
T1091 Replication Through Removable MediaLM/IA 7 6 8
T1204 User ExecutionE 7 2 85
T1217 Browser Information DiscoveryD 7 1 4
T1560.001 Archive via UtilityC 7 2 28
T1564.003 Hidden WindowDE 7 0 11
T1018 Remote System DiscoveryD 6 2 55
T1027.002 Software PackingDE 6 0 1
T1048 Exfiltration Over Alternative ProtocolE 6 4 39
T1057 Process DiscoveryD 6 0 29
T1070 Indicator RemovalDE 6 3 70
T1199 Trusted RelationshipIA 6 1 6
T1518 Software DiscoveryD 6 0 20
T1518.001 Security Software DiscoveryD 6 0 12
T1552 Unsecured CredentialsCA 6 4 133
T1555.003 Credentials from Web BrowsersCA 6 0 16
T1571 Non-Standard PortCaC 6 1 14
T1574.001 DLLDE/E 6 0 123
T1003.001 LSASS MemoryCA 5 4 113
T1037 Boot or Logon Initialization ScriptsP/PE 5 3 30 rule
T1047 Windows Management InstrumentationE 5 2 94
T1087.002 Domain AccountD 5 5 60
T1195.002 Compromise Software Supply ChainIA 5 2 41 rule
T1490 Inhibit System RecoveryI 5 2 67
T1497.001 System ChecksDE/D 5 0 6
T1539 Steal Web Session CookieCA 5 0 22
T1543.003 Windows ServiceP/PE 5 0 92
T1548 Abuse Elevation Control MechanismPE 5 4 105
T1550.002 Pass the HashLM 5 4 10
T1566.004 Spearphishing VoiceIA 5 0 0 rule
T1567 Exfiltration Over Web ServiceE 5 3 61
T1569.002 Service ExecutionE 5 1 67
T1573 Encrypted ChannelCaC 5 0 12 rule
T1583.006 Web ServicesRD 5 0 2 pre
T1614 System Location DiscoveryD 5 0 2
T1622 Debugger EvasionDE/D 5 2 1
T1010 Application Window DiscoveryD 4 0 1
T1011 Exfiltration Over Other Network MediumE 4 4 2
T1012 Query RegistryD 4 0 29
T1021 Remote ServicesLM 4 4 111
T1036.004 Masquerade Task or ServiceDE 4 0 8
T1055.001 Dynamic-link Library InjectionDE/PE 4 1 14
T1055.012 Process HollowingDE/PE 4 1 10
T1056.001 KeyloggingC/CA 4 1 4
T1059.006 PythonE 4 0 61
T1090.001 Internal ProxyCaC 4 1 10
T1095 Non-Application Layer ProtocolCaC 4 0 25
T1098.005 Device RegistrationP/PE 4 0 29 rule
T1111 Multi-Factor Authentication InterceptionCA 4 0 1 rule
T1114 Email CollectionC 4 3 19
T1119 Automated CollectionC 4 1 14
T1136.001 Local AccountP 4 2 45
T1204.004 Malicious Copy and PasteE 4 0 12 rule
T1210 Exploitation of Remote ServicesLM 4 4 49
T1212 Exploitation for Credential AccessCA 4 4 13
T1528 Steal Application Access TokenCA 4 1 64
T1548.001 Setuid and SetgidPE 4 1 32
T1548.002 Bypass User Account ControlPE 4 1 85
T1558 Steal or Forge Kerberos TicketsCA 4 3 28
T1567.002 Exfiltration to Cloud StorageE 4 0 35
T1583 Acquire InfrastructureRD 4 0 4 pre
T1587.001 MalwareRD 4 0 12 pre
T1588.001 MalwareRD 4 2 2 pre
T1588.002 ToolRD 4 0 12 pre
T1596.005 Scan DatabasesR 4 0 0 pre
T1001 Data ObfuscationCaC 3 2 2
T1003.003 NTDSCA 3 3 36
T1021.001 Remote Desktop ProtocolLM 3 2 51
T1021.004 SSHLM 3 2 39
T1027.009 Embedded PayloadsDE 3 0 2
T1040 Network SniffingCA/D 3 2 17
T1053 Scheduled Task/JobE/P/PE 3 2 57
T1056 Input CaptureC/CA 3 3 7
T1074.001 Local Data StagingC 3 0 12
T1090.003 Multi-hop ProxyCaC 3 0 8
T1098 Account ManipulationP/PE 3 2 273
T1098.001 Additional Cloud CredentialsP/PE 3 0 36
T1098.003 Additional Cloud RolesP/PE 3 0 68
T1102.001 Dead Drop ResolverCaC 3 0 10 rule
T1110 Brute ForceCA 3 2 97
T1110.003 Password SprayingCA 3 0 71
T1115 Clipboard DataC 3 0 16
T1132.001 Standard EncodingCaC 3 0 7
T1185 Browser Session HijackingC 3 3 13
T1195 Supply Chain CompromiseIA 3 1 43
T1213 Data from Information RepositoriesC 3 2 38
T1218 System Binary Proxy ExecutionDE 3 2 266
T1218.011 Rundll32DE 3 0 91 rule
T1221 Template InjectionDE 3 3 2
T1222 File and Directory Permissions ModificationDE 3 1 27
T1526 Cloud Service DiscoveryD 3 0 36
T1556 Modify Authentication ProcessDE/P/CA 3 2 81
T1560 Archive Collected DataC 3 0 16
T1565 Data ManipulationI 3 2 22
T1566.003 Spearphishing via ServiceIA 3 0 2
T1572 Protocol TunnelingCaC 3 0 63
T1583.003 Virtual Private ServerRD 3 0 0 pre
T1584.005 BotnetRD 3 2 0 pre
T1611 Escape to HostPE 3 3 56
T1620 Reflective Code LoadingDE 3 0 15
T1007 System Service DiscoveryD 2 1 17
T1020 Automated ExfiltrationE 2 0 19
T1036.008 Masquerade File TypeDE 2 0 8
T1039 Data from Network Shared DriveC 2 0 9
T1049 System Network Connections DiscoveryD 2 1 26
T1053.003 CronE/P/PE 2 0 28
T1055.004 Asynchronous Procedure CallDE/PE 2 0 2
T1056.003 Web Portal CaptureC/CA 2 0 0 gap
T1059.005 Visual BasicE 2 0 55
T1069.002 Domain GroupsD 2 0 48
T1071.002 File Transfer ProtocolsCaC 2 1 1
IDTechniqueSigKEVRulesState
T1071.004 DNSCaC 2 0 40 rule
T1078.003 Local AccountsDE/P/PE/IA 2 1 25
T1087.004 Cloud AccountD 2 0 24
T1098.004 SSH Authorized KeysP/PE 2 1 14 rule
T1102 Web ServiceCaC 2 0 37
T1120 Peripheral Device DiscoveryD 2 0 4
T1134 Access Token ManipulationDE/PE 2 0 27
T1187 Forced AuthenticationCA 2 0 24
T1480 Execution GuardrailsDE 2 0 1
T1482 Domain Trust DiscoveryD 2 2 40
T1484.001 Group Policy ModificationDE/PE 2 1 19
T1489 Service StopI 2 1 58
T1491.001 Internal DefacementI 2 0 4
T1495 Firmware CorruptionI 2 2 1
T1497.003 Time Based ChecksDE/D 2 0 4
T1499.002 Service Exhaustion FloodI 2 2 2
T1499.004 Application or System ExploitationI 2 2 6
T1505 Server Software ComponentP 2 2 37
T1530 Data from Cloud StorageC 2 2 37
T1531 Account Access RemovalI 2 1 35
T1547 Boot or Logon Autostart ExecutionP/PE 2 1 64
T1547.009 Shortcut ModificationP/PE 2 1 7
T1553 Subvert Trust ControlsDE 2 0 24
T1553.002 Code SigningDE 2 0 5
T1553.005 Mark-of-the-Web BypassDE 2 2 12
T1555.004 Windows Credential ManagerCA 2 0 9
T1564 Hide ArtifactsDE 2 0 52
T1565.001 Stored Data ManipulationI 2 2 25
T1570 Lateral Tool TransferLM 2 1 22
T1573.002 Asymmetric CryptographyCaC 2 0 7
T1583.004 ServerRD 2 0 0 pre
T1585.002 Email AccountsRD 2 0 0 pre
T1585.003 Cloud AccountsRD 2 0 0 pre
T1586.001 Social Media AccountsRD 2 0 1 pre
T1588 Obtain CapabilitiesRD 2 1 3 pre
T1588.005 ExploitsRD 2 0 0 pre
T1591 Gather Victim Org InformationR 2 0 0 pre
T1592 Gather Victim Host InformationR 2 2 4 pre
T1595 Active ScanningR 2 1 32 pre
T1595.002 Vulnerability ScanningR 2 0 12 pre
T1598.003 Spearphishing LinkR 2 0 0 pre
T1649 Steal or Forge Authentication CertificatesCA 2 0 26
T1657 Financial TheftI 2 0 1
T1678 Delay ExecutionDE 2 0 0 gap
T1001.001 Junk DataCaC 1 0 0 gap
T1003.002 Security Account ManagerCA 1 0 47
T1003.004 LSA SecretsCA 1 0 18
T1003.006 DCSyncCA 1 0 14
T1003.008 /etc/passwd and /etc/shadowCA 1 1 13
T1008 Fallback ChannelsCaC 1 0 5
T1021.002 SMB/Windows Admin SharesLM 1 0 72
T1021.005 VNCLM 1 0 2
T1027.007 Dynamic API ResolutionDE 1 0 0 gap
T1027.012 LNK Icon SmugglingDE 1 0 0 gap
T1027.016 Junk Code InsertionDE 1 0 0 gap
T1036.001 Invalid Code SignatureDE 1 0 17
T1036.007 Double File ExtensionDE 1 0 4
T1037.001 Logon Script (Windows)P/PE 1 0 4
T1037.004 RC ScriptsP/PE 1 0 11
T1048.001 Exfiltration Over Symmetric Encrypted Non-C2 ProtocolE 1 0 2
T1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolE 1 1 24
T1052.001 Exfiltration over USBE 1 0 4
T1055.002 Portable Executable InjectionDE/PE 1 0 4
T1055.008 Ptrace System CallsDE/PE 1 0 4
T1069 Permission Groups DiscoveryD 1 1 40
T1070.006 TimestompDE 1 0 10
T1070.009 Clear PersistenceDE 1 0 0 gap
T1078.002 Domain AccountsDE/P/PE/IA 1 0 27
T1087.001 Local AccountD 1 1 37
T1090.002 External ProxyCaC 1 0 10
T1102.002 Bidirectional CommunicationCaC 1 0 18
T1114.002 Remote Email CollectionC 1 1 16
T1123 Audio CaptureC 1 0 8
T1124 System Time DiscoveryD 1 0 5
T1125 Video CaptureC 1 0 5
T1134.001 Token Impersonation/TheftDE/PE 1 1 21
T1134.002 Create Process with TokenDE/PE 1 0 14
T1135 Network Share DiscoveryD 1 0 22
T1137 Office Application StartupP 1 0 19
T1137.006 Add-insP 1 0 6
T1195.001 Compromise Software Dependencies and Development ToolsIA 1 0 11
T1197 BITS JobsDE/P/E 1 0 25
T1200 Hardware AdditionsIA 1 0 8
T1211 Exploitation for StealthDE 1 1 7
T1218.007 MsiexecDE 1 0 37
T1218.010 Regsvr32DE 1 0 41
T1219.002 Remote Desktop SoftwareCaC 1 0 59
T1480.002 Mutual ExclusionDE 1 0 0 gap
T1491.002 External DefacementI 1 1 1
T1496.001 Compute HijackingI 1 0 2
T1497.002 User Activity Based ChecksDE/D 1 0 0 gap
T1498.001 Direct Network FloodI 1 1 1
T1529 System Shutdown/RebootI 1 0 19
T1542.005 TFTP BootDE/P 1 1 0 gap
T1546 Event Triggered ExecutionPE/P 1 0 84
T1546.001 Change Default File AssociationPE/P 1 0 7
T1546.002 ScreensaverPE/P 1 0 8
T1546.003 Windows Management Instrumentation Event SubscriptionPE/P 1 0 18
T1546.004 Unix Shell Configuration ModificationPE/P 1 0 15
T1546.007 Netsh Helper DLLPE/P 1 0 5
T1546.010 AppInit DLLsPE/P 1 0 2
T1546.012 Image File Execution Options InjectionPE/P 1 0 8
T1546.013 PowerShell ProfilePE/P 1 0 4
T1546.015 Component Object Model HijackingPE/P 1 0 14
T1547.002 Authentication PackageP/PE 1 0 3
T1547.004 Winlogon Helper DLLP/PE 1 0 5
T1547.005 Security Support ProviderP/PE 1 0 6
T1547.008 LSASS DriverP/PE 1 0 2
T1547.010 Port MonitorsP/PE 1 0 6
T1550 Use Alternate Authentication MaterialLM 1 0 75
T1550.001 Application Access TokenLM 1 0 52
T1550.004 Web Session CookieLM 1 0 4
T1552.003 Shell HistoryCA 1 0 4
T1552.004 Private KeysCA 1 1 25
T1553.001 Gatekeeper BypassDE 1 0 7
T1555.001 KeychainCA 1 0 7
T1555.005 Password ManagersCA 1 0 4
T1555.006 Cloud Secrets Management StoresCA 1 0 11
T1556.006 Multi-Factor AuthenticationDE/P/CA 1 0 28
T1557.001 Name Resolution Poisoning and SMB RelayCA/C 1 1 23
T1558.003 KerberoastingCA 1 0 34
T1559 Inter-Process CommunicationE 1 0 20
T1559.001 Component Object ModelE 1 0 17
T1560.002 Archive via LibraryC 1 0 3
T1564.001 Hidden Files and DirectoriesDE 1 0 29
T1564.004 NTFS File AttributesDE 1 0 33
T1564.008 Email Hiding RulesDE 1 0 9
T1564.010 Process Argument SpoofingDE 1 0 0 gap
T1567.004 Exfiltration Over WebhookE 1 0 2
T1574.006 Dynamic Linker HijackingDE/E 1 0 24
T1580 Cloud Infrastructure DiscoveryD 1 0 33
T1584 Compromise InfrastructureRD 1 0 7 pre
T1586.002 Email AccountsRD 1 0 0 pre
T1587 Develop CapabilitiesRD 1 0 7 pre
T1587.002 Code Signing CertificatesRD 1 0 1 pre
T1587.003 Digital CertificatesRD 1 0 1 pre
T1588.003 Code Signing CertificatesRD 1 0 0 pre
T1588.006 VulnerabilitiesRD 1 1 0 pre
T1588.007 Artificial IntelligenceRD 1 0 0 pre
T1589.001 CredentialsR 1 0 2 pre
T1589.002 Email AddressesR 1 0 2 pre
T1589.003 Employee NamesR 1 0 0 pre
T1590 Gather Victim Network InformationR 1 0 6 pre
T1591.004 Identify RolesR 1 0 2 pre
T1593.001 Social MediaR 1 0 0 pre
T1596.003 Digital CertificatesR 1 0 0 pre
T1598 Phishing for InformationR 1 0 1 pre
T1598.002 Spearphishing AttachmentR 1 1 2 pre
T1601 Modify System ImageDE 1 1 1
T1602 Data from Configuration RepositoryC 1 1 1
T1602.002 Network Device Configuration DumpC 1 0 1
T1608 Stage CapabilitiesRD 1 0 12 pre
T1608.005 Link TargetRD 1 0 0 pre
T1610 Deploy ContainerE 1 0 35
T1614.001 System Language DiscoveryD 1 0 2
T1650 Acquire AccessRD 1 0 0 pre
T1653 Power SettingsP 1 1 1
T1659 Content InjectionIA/CaC 1 0 0 gap
T1665 Hide InfrastructureCaC 1 0 0 gap
T1667 Email BombingI 1 0 0 gap
T1680 Local Storage DiscoveryD 1 0 0 gap
T1684 Social EngineeringDE 1 0 0 gap
T1684.001 ImpersonationDE 1 0 0 gap
T1684.002 Email SpoofingDE 1 0 0 gap
T1685 Disable or Modify ToolsDE 1 0 284
T1685.005 Clear Windows Event LogsDE 1 0 13
T1686 Disable or Modify System FirewallDE 1 0 18
T1686.003 Windows Host FirewallDE 1 0 20
T1688 Safe Mode BootDE 1 0 1

Signal = research citations (last 90 days) + KEV CVEs mapped (CTID) + active-family presence. Coverage = SigmaHQ, Elastic and Splunk production rules tagged to the technique. Structural exclusion: pre-compromise tactics (Reconnaissance, Resource Development) are not writable detection gaps. Source: MITRE ATT&CK & CTID mappings · CISA KEV · vendor research and advisories · SigmaHQ · Elastic · Splunk · 2026-11-07.